diff --git a/it-and-security/lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig b/it-and-security/lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig
new file mode 100644
index 0000000000..ebd5c8ffd3
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PayloadContent</key>
+	<array>
+		<dict>
+			<key>PayloadDisplayName</key>
+			<string>1Password</string>
+			<key>PayloadIdentifier</key>
+			<string>com.1password.1password.1751576D-172A-408C-88F4-2EB754081022</string>
+			<key>PayloadType</key>
+			<string>com.1password.1password</string>
+			<key>PayloadUUID</key>
+			<string>1751576D-172A-408C-88F4-2EB754081022</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+			<key>updates.autoUpdate</key>
+			<true/>
+		</dict>
+	</array>
+	<key>PayloadDisplayName</key>
+	<string>Automatically check for 1Password updates</string>
+	<key>PayloadIdentifier</key>
+	<string>com.fleetdm.4AF68654-3F58-4ACC-8D10-131B472BBD40</string>
+	<key>PayloadType</key>
+	<string>Configuration</string>
+	<key>PayloadUUID</key>
+	<string>4AF68654-3F58-4ACC-8D10-131B472BBD40</string>
+	<key>PayloadVersion</key>
+	<integer>1</integer>
+</dict>
+</plist>
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index f52965dbf3..58b3c09e84 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -88,6 +88,9 @@ controls:
       - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
       - path: ../lib/macos/declaration-profiles/passcode-settings.json
       - path: ../lib/macos/declaration-profiles/software-update-settings.json
+      - path: ../lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig
+        labels_include_any:
+          - "Macs with 1Password8 installed"
   macos_setup:
     bootstrap_package: ""
     enable_end_user_authentication: false